1. Field of the Invention
The present application relates to wireless networking and, in some preferred embodiments, to methods of carrying out intrusion detection and/or other processing in multi-hop wireless networks and/or the like.
2. General Background Discussion
Networks and Internet Protocol
There are many types of computer networks, with the Internet having the most notoriety. The Internet is a worldwide network of computer networks. Today, the Internet is a public and self-sustaining network that is available to many millions of users. The Internet uses a set of communication protocols called TCP/IP (i.e., Transmission Control Protocol/Internet Protocol) to connect hosts. The Internet has a communications infrastructure known as the Internet backbone. Access to the Internet backbone is largely controlled by Internet Service Providers (ISPs) that resell access to corporations and individuals. In this disclosure, the terminology network is used broadly and includes individual networks and multiple networks networked together.
With respect to IP (Internet Protocol), this is a protocol by which data can be sent from one device (e.g., a phone, a PDA [Personal Digital Assistant], a computer, etc.) to another device on a network. There are a variety of versions of IP today, including, e.g., IPv4, IPv6, etc. Each host device on the network has at least one IP address that is its own unique identifier.
IP is a connectionless protocol. The connection between end points during a communication is not continuous. When a user sends or receives data or messages, the data or messages are divided into components known as packets. Every packet is treated as an independent unit of data.
In order to standardize the transmission between points over the Internet or the like networks, an OSI (Open Systems Interconnection) model was established. The OSI model separates the communications processes between two points in a network into seven stacked layers, with each layer adding its own set of functions. Each device handles a message so that there is a downward flow through each layer at a sending end point and an upward flow through the layers at a receiving end point. The programming and/or hardware that provides the seven layers of function is typically a combination of device operating systems, application software, TCP/IP and/or other transport and network protocols, and other software and hardware.
Typically, the top four layers are used when a message passes from or to a user and the bottom three layers are used when a message passes through a device (e.g., an IP host device). An IP host is any device on the network that is capable of transmitting and receiving IP packets, such as a server, a router or a workstation. Messages destined for some other host are not passed up to the upper layers but are forwarded to the other host. In the OSI and other similar models, IP is in Layer-3, the network layer.
Wireless Networks
Wireless networks can incorporate a variety of types of mobile devices, such as, e.g., cellular and wireless telephones, PCs (personal computers), laptop computers, wearable computers, cordless phones, pagers, headsets, printers, PDAs, etc. For example, mobile devices may include digital systems to secure fast wireless transmissions of voice and/or data. Typical mobile devices include some or all of the following components: a transceiver (i.e., a transmitter and a receiver, including, e.g., a single chip transceiver with an integrated transmitter, receiver and, if desired, other functions); an antenna; a processor; one or more audio transducers (for example, a speaker or a microphone as in devices for audio communications); electromagnetic data storage (such as, e.g., ROM, RAM, digital data storage, etc., such as in devices where data processing is provided); memory; flash memory; a full chip set or integrated circuit; interfaces (such as, e.g., USB, CODEC, UART, PCM, etc.); and/or the like.
Wireless LANs (WLANs) in which a mobile user can connect to a local area network (LAN) through a wireless connection may be employed for wireless communications. Wireless communications can include, e.g., communications that propagate via electromagnetic waves, such as light, infrared, radio, microwave. There are a variety of WLAN standards that currently exist, such as, e.g., Bluetooth, IEEE 802.11, and HomeRF.
By way of example, Bluetooth products may be used to provide links between mobile computers, mobile phones, portable handheld devices, personal digital assistants (PDAs), and other mobile devices and connectivity to the Internet. Bluetooth is a computing and telecommunications industry specification that details how mobile devices can easily interconnect with each other and with non-mobile devices using a short-range wireless connection. Bluetooth creates a digital wireless protocol to address end-user problems arising from the proliferation of various mobile devices that need to keep data synchronized and consistent from one device to another, thereby allowing equipment from different vendors to work seamlessly together. Bluetooth devices may be named according to a common naming concept. For example, a Bluetooth device may possess a Bluetooth Device Name (BDN) or a name associated with a unique Bluetooth Device Address (BDA). Bluetooth devices may also participate in an Internet Protocol (IP) network. If a Bluetooth device functions on an IP network, it may be provided with an IP address and an IP (network) name. Thus, a Bluetooth Device configured to participate on an IP network may contain, e.g., a BDN, a BDA, an IP address and an IP name. The term “IP name” refers to a name corresponding to an IP address of an interface.
An IEEE standard, IEEE 802.11, specifies technologies for wireless LANs and devices. Using 802.11, wireless networking may be accomplished with each single base station supporting several devices. In some examples, devices may come pre-equipped with wireless hardware or a user may install a separate piece of hardware, such as a card, that may include an antenna. By way of example, devices used in 802.11 typically include three notable elements, whether or not the device is an access point (AP), a mobile station (STA), a bridge, a PCMCIA card or another device: a radio transceiver; an antenna; and a MAC (Media Access Control) layer that controls packet flow between points in a network.
In addition, Multiple Interface Devices (MIDs) may be utilized in some wireless networks. MIDs may contain two independent network interfaces, such as a Bluetooth interface and an 802.11 interface, thus allowing the MID to participate on two separate networks as well as to interface with Bluetooth devices. The MID may have an IP address and a common IP (network) name associated with the IP address.
Wireless network devices may include, but are not limited to Bluetooth devices, Multiple Interface Devices (MIDs), 802.11x devices (IEEE 802.11 devices including, e.g., 802.11a, 802.11b and 802.11g devices), HomeRF (Home Radio Frequency) devices, Wi-Fi (Wireless Fidelity) devices, GPRS (General Packet Radio Service) devices, 3G cellular devices, 2.5G cellular devices, GSM (Global System for Mobile Communications) devices, EDGE (Enhanced Data for GSM Evolution) devices, TDMA type (Time Division Multiple Access) devices, or CDMA type (Code Division Multiple Access) devices, including CDMA2000. Each network device may contain addresses of varying types including but not limited to an IP address, a Bluetooth Device Address, a Bluetooth Common Name, a Bluetooth IP address, a Bluetooth IP Common Name, an 802.11 IP Address, an 802.11 IP common Name, or an IEEE MAC address.
Wireless networks can also involve methods and protocols found in, e.g., Mobile IP (Internet Protocol) systems, in PCS systems, and in other mobile network systems. With respect to Mobile IP, this involves a standard communications protocol created by the Internet Engineering Task Force (IETF). With Mobile IP, mobile device users can move across networks while maintaining their IP Address assigned once. See Request for Comments (RFC) 3344. NB: RFCs are formal documents of the Internet Engineering Task Force (IETF). Mobile IP enhances Internet Protocol (IP) and adds means to forward Internet traffic to mobile devices when connecting outside their home network. Mobile IP assigns each mobile node a home address on its home network and a care-of-address (CoA) that identifies the current location of the device within a network and its subnets. When a device is moved to a different network, it receives a new care-of address. A mobility agent on the home network can associate each home address with its care-of address. The mobile node can send the home agent a binding update each time it changes its care-of address using, e.g., Internet Control Message Protocol (ICMP).
In basic IP routing (i.e. outside mobile IP), typically, routing mechanisms rely on the assumptions that each network node always has a constant attachment point to, e.g., the Internet and that each node's IP address identifies the network link it is attached to. In this document, the terminology “node” includes a connection point, which can include, e.g., a redistribution point or an end point for data transmissions, and which can recognize, process and/or forward communications to other nodes. For example, Internet routers can look at, e.g., an IP address prefix or the like identifying a device's network. Then, at a network level, routers can look at, e.g., a set of bits identifying a particular subnet. Then, at a subnet level, routers can look at, e.g., a set of bits identifying a particular device. With typical mobile IP communications, if a user disconnects a mobile device from, e.g., the Internet and tries to reconnect it at a new subnet, then the device has to be reconfigured with a new IP address, a proper netmask and a default router. Otherwise, routing protocols would not be able to deliver the packets properly.
Multi-Hop Networking
In a packet-switching network, a hop is the trip a data packet takes from one node (e.g., router or intermediate point) to another node in the network. On the Internet (or another network that uses, e.g., TCP/IP), the number of hops a packet has taken toward its destination (called the “hop count”) may be kept in a packet header. Over the Internet and in some other networks, such as, e.g., in some mesh networks or the like, a multi-hop network is employed that may follow a multi-hop path between the source and the destination nodes, such as, e.g., by hopping between routers, etc., along the communication path.
In packet-switched networks such as the Internet, a router can be, e.g., a device or software in a computer that determines the next network point to which a packet should be forwarded to (e.g., to reach is ultimate destination). The router may be, e.g., connected to two or more networks and the router may decide which way to send each information packet based on its current understanding of the state of the network(s) it is connected to. A router can be located at, e.g., a gateway (e.g., where one network meets another). A router can also be included as part of a network switch.
A router may, in some examples, create or maintain a table of the available routes and their conditions and use this information along with, e.g., distance and cost algorithms to determine the best route for a given packet. In some common examples, a packet may travel through a number of network points with routers before arriving at its destination. Routing is typically a function associated with the network layer (i.e., layer 3) of the OSI model. In that regard, a layer-3 switch is a switch that can perform routing functions.
Intrusion Into Wireless Networks
The present inventor has determined that in wireless multi-hop networks marked by, e.g., resource constrained devices there is a need to perform certain capture and analysis and other processes efficiently, such as, e.g., to perform intrusion detection, to perform compression and/or decompression, etc. The efficiency aspect of this can address not only the incapability of certain devices to perform this processing but can also address the overheads associated with such processing if done redundantly.
In contrast to wireline networks, wireless networks have substantially different constraints and conditions. In the context of wireline networks, capture of packets and their analysis can be done at a gateway which is a point at which traffic enters and/or leaves the enterprise network. Such a chokepoint might not exist for wireless networks. Further, wireline networks do not have similar constraints on resources such as, e.g., processing power, bandwidth, memory, etc., as are confronted by wireless networks, rendering solutions for wireless networks to have significantly different requirements and considerations.
A few illustrative existing systems and methods to perform intrusion detection are described in the following references:                1) Zhang and Lee, “Intrusion Detection in Wireless Ad-Hoc Networks,” Mobicom 2000;        2) Marti S., Guili T., Lai K. and Baker M., “Mitigating Routing Misbehavior in Mobile Ad Hoc Networks,” Mobicom 2000; and        3) Subhadrabandhu D. Sarkar S and Anjum F., “Efficacy of Misuse Detection in Adhoc Networks,” Secon 2004.        
Nevertheless, the systems and methods described in these references a) fail to achieve efficient solutions and/or b) assume other factors such as promiscuous monitoring. In addition, the present inventor has determined that wireless networks have other associated resource constraints and that it is not practical to use solutions that require inefficient resource usage, such as, e.g., in the above references.
With respect to references 1) and 2), it can be seen that these references require that every node in the system capture and analyze all packets. Thus, with the systems and methods of these references 1) and 2), a packet transmitted between a source and a destination will be analyzed N times if there are N nodes between the source and destination.
With respect to reference 3), the reference describes a system that works only in a promiscuous mode. In this regard, in a promiscuous mode, a network device intercepts and reads each network packet that arrives in its entirety. Once again, in reference 3), more than one node can analyze a packet.
While a variety of systems and methods are known, there remains a need for improved systems and methods.